Chrome may start restricting requests to private networks

Re:Chrome may start restricting requests to private networks by tzs on Tuesday November 16, 2021 @11:37AM (#29242602)

I'd be a lot more likely to be thrilled by it if the browsers had a persistent per page or per site setting to disable these kind of things.

It gets annoying when a page I write loaded onto my table on my LAN's WiFi cannot talk to devices I own on my LAN just because I loaded the page from my server that is on the public Internet.

PS:

> The modern countermeasure for this is to require devices parked on private networks to opt-in to the ability mix public Internet requests with private network accesses, using CORS, which is what this is about

I predict that most IoT devices won't have a way to configure this.

If the manufacturer intended it to be controllable from some web app from their site, they will opt-in to control from everyone. If the manufacturer only wants it controlled from their mobile app, they will explicitly opt-out of web control if that is possible.

[ Parent | on HN ]

Re:Chrome may start restricting requests to private networks by tptacek on Tuesday November 16, 2021 @01:06PM (#29244069)

Just to be clear: the people working on PNA thought about how likely it was for IOT devices to support this, and the default behavior for most devices is expected to be fail-closed.

[ Parent | on HN ]